{"record":{"id":"d7839ec203200808","repo":"shadow1ng/fscan","slug":"local-pe-not-found-d7839e","errorCode":null,"errorMessage":"local_pe_not_found","messagePattern":"local_pe_not_found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winregistry.go","lineNumber":34,"sourceCode":")\n\ntype WinRegistryPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinRegistryPlugin() *WinRegistryPlugin {\n\treturn &WinRegistryPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winregistry\"),\n\t}\n}\n\nfunc (p *WinRegistryPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tbaseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))\n\n\tentries := []struct {\n\t\tkey  string\n\t\tname string\n\t\tdesc string\n\t}{\n\t\t{`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`, fmt.Sprintf(\"WindowsUpdate_%s\", baseName), i18n.GetText(\"winregistry_current_user_run\")},\n\t\t{`HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`, fmt.Sprintf(\"SystemUpdate_%s\", baseName), i18n.GetText(\"winregistry_local_machine_run\")},\n\t\t{`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce`, fmt.Sprintf(\"SetupComplete_%s\", baseName), i18n.GetText(\"winregistry_current_user_runonce\")},\n\t}\n\n\tvar output strings.Builder\n\tvar successCount int\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winregistry.go#L16-L52","documentation":"WinRegistryPlugin.Scan stats the path in session.Config.WinPEFile to confirm the local PE file exists before parsing registry autoruns. If os.Stat fails (file missing, bad path, no permission), it returns this localized error with the path interpolated. The plugin does not touch the registry unless the file is present locally.","triggerScenarios":"Config.WinPEFile is non-empty but os.Stat(pePath) returns an error: the file does not exist at that path, the path is misspelled/relative to the wrong working directory, or the stat is blocked by permissions.","commonSituations":"Typo in the PE file path; running the tool from a different CWD than expected with a relative path; the sample file was deleted/moved after configuration; pointing at a path on a drive that is not mounted.","solutions":["Verify the file exists at the configured path (ls/Test-Path) and correct Config.WinPEFile.","Use an absolute path so the result does not depend on the process working directory.","Check read permissions on the file and its parent directories.","Re-download or restore the PE sample if it was removed."],"exampleFix":"// before\nsession.Config.WinPEFile = \"samples/implant.dll\" // CWD differs -> not found\n// after\nabs, _ := filepath.Abs(\"samples/implant.dll\")\nif _, err := os.Stat(abs); err != nil { log.Fatal(err) }\nsession.Config.WinPEFile = abs","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(cfg.WinPEFile); err != nil {\n    return fmt.Errorf(\"PE file %q not accessible: %w\", cfg.WinPEFile, err)\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, host, session)\nif !res.Success {\n    var peErr *os.PathError\n    if errors.As(res.Error, &peErr) { /* handle missing file */ }\n}","preventionTips":["Use absolute paths for sample files in configs.","Stat the file right after loading config to fail fast.","Keep samples in a stable, permission-correct directory; watch for AV quarantine."],"tags":["file-not-found","windows","pe-file","local-scan"],"backgroundTag":"file-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}